PT-2026-33268

Name of the Vulnerable Software and Affected Versions Accessibility Suite by Ability, Inc versions prior to 4.21 Description The Accessibility Suite by Ability, Inc plugin for WordPress contains a flaw allowing authenticated attackers with Subscriber-level access or higher to perform SQL Injectio...

PT-2026-33354

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the API datasource saving process. The deTableName field from the Base64-encoded datasource configuration is used to construct a DDL statement via simple strin...

CVE-2026-37345

The SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection due to improper neutralization of special elements in the /parking/manage_park.php file. This vulnerability allows an attacker to insert malicious SQL statements into entry fields to execute unauthorized...

DataEase 安全漏洞

DataEase is an open-source data visualization and analysis tool developed by DataEase. It helps users quickly analyze data and gain insights into business trends, thereby enabling improvements and optimizations in their businesses. DataEase versions 2.10.20 and earlier contain security...

SourceCodester Vehicle Parking Area Management System 安全漏洞

The SourceCodester Vehicle Parking Area Management System is an open-source parking management system developed by SourceCodester. Version 1.0 of the SourceCodester Vehicle Parking Area Management System contains a security vulnerability, which stems from the file /parking/viewparkeddetails.php...

EUVD-2026-23251

SourceCodester Simple Music Cloud Community System v1.0 is vulnerable to SQL Injection in the file /music/viewplaylist.php...

CVE-2026-37344

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/managelocation.php...

CVE-2026-37341

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/managecategory.php...

CVE-2026-37344

The SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection within the /parking/manage_location.php file. This vulnerability allows an attacker to interfere with the queries the application makes to its database. No exploit details or specific remediation version...

CVE-2026-37343

SourceCodester Vehicle Parking Area Management System v1.0 is vulnerable to SQL Injection in the file /parking/manageuser.php...

PT-2026-33359

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /datasource/getTableField endpoint. The getTableFiledSql method in CalciteProvider.java incorporates the tableName parameter directly into SQL query string...

DataEase 安全漏洞

DataEase is an open-source data visualization and analysis tool developed by DataEase. It helps users quickly analyze data and gain insights into business trends, thereby enabling improvements and optimizations in their businesses. DataEase versions 2.10.20 and earlier contain security...

DRUPAL-CORE-2026-002

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application...

EUVD-2026-22989

Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereadorver.php endpoint...

PT-2026-33101

CVE-2026-30995 Slah CMS v1.5.0 and below was discovered to contain a SQL injection vulnerability via the id parameter in the vereador ver.php endpoint. https://t.co/FW642LmQMP...

Drupal core - Moderately critical - Gadget Chain - SA-CORE-2026-002

Drupal core contains a chain of methods that could be exploitable when an insecure deserialization vulnerability exists on the site. This so-called "gadget chain" presents no direct threat, but is a vector that can be used to achieve remote code execution or SQL injection if the application...

SQL Injection

Overview @vendure/core is an A modern, headless ecommerce framework Affected versions of this package are vulnerable to SQL Injection via the ProductService.findOneBySlug function in Admin and Vendure Shop API. An attacker can execute arbitrary SQL commands on the database by supplying a crafted...

CVE-2026-36232

A SQL injection vulnerability was found in the instructorClasses.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that the 'classId' parameter from $GET'classId' is directly concatenated into the SQL query without any sanitization or validation...

CVE-2026-36233

A SQL injection vulnerability was found in the assignInstructorSubjects.php file of itsourcecode Online Student Enrollment System v1.0. The reason for this issue is that attackers can inject malicious code via the parameter "subjcode" and use it directly in SQL queries without the need for...

CVE-2026-6037

A vulnerability was determined in code-projects Vehicle Showroom Management System 1.0. This affects an unknown function of the file /util/AddVehicleFunction.php. This manipulation of the argument BRANCHID causes sql injection. The attack is possible to be carried out remotely. The exploit has be...